| From 11ebb5813841272e2b23d0bcf80c2a93b66c7bbf Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 10 Jun 2025 07:42:26 +0530 |
| Subject: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap |
| |
| From: Ritesh Harjani (IBM) <ritesh.list@gmail.com> |
| |
| [ Upstream commit cd097df4596f3a1e9d75eb8520162de1eb8485b2 ] |
| |
| memtrace mmap issue has an out of bounds issue. This patch fixes the by |
| checking that the requested mapping region size should stay within the |
| allocated region size. |
| |
| Reported-by: Jonathan Greental <yonatan02greental@gmail.com> |
| Fixes: 08a022ad3dfa ("powerpc/powernv/memtrace: Allow mmaping trace buffers") |
| Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> |
| Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> |
| Link: https://patch.msgid.link/20250610021227.361980-1-maddy@linux.ibm.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- |
| 1 file changed, 6 insertions(+), 2 deletions(-) |
| |
| diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c |
| index 877720c645151..35471b679638a 100644 |
| --- a/arch/powerpc/platforms/powernv/memtrace.c |
| +++ b/arch/powerpc/platforms/powernv/memtrace.c |
| @@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf, |
| static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma) |
| { |
| struct memtrace_entry *ent = filp->private_data; |
| + unsigned long ent_nrpages = ent->size >> PAGE_SHIFT; |
| + unsigned long vma_nrpages = vma_pages(vma); |
| |
| - if (ent->size < vma->vm_end - vma->vm_start) |
| + /* The requested page offset should be within object's page count */ |
| + if (vma->vm_pgoff >= ent_nrpages) |
| return -EINVAL; |
| |
| - if (vma->vm_pgoff << PAGE_SHIFT >= ent->size) |
| + /* The requested mapping range should remain within the bounds */ |
| + if (vma_nrpages > ent_nrpages - vma->vm_pgoff) |
| return -EINVAL; |
| |
| vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); |
| -- |
| 2.39.5 |
| |
